     (e/grant-guest (s/context) (e/coll-catalog-item-id "PROV1" (e/coll-id ["coll1"])))
     (e/grant-guest (s/context) (e/coll-catalog-item-id "PROV1" (e/coll-id ["notexist"])))
     ;; restriction flag acl grants matches coll4
-    (e/grant-guest (s/context) (e/coll-catalog-item-id "PROV1" (e/coll-id ["coll4"] {:min-value 4 :max-value 6})))
+    (e/grant-guest (s/context) (e/coll-catalog-item-id
+                                "PROV1" (e/coll-id ["coll4"] {:min-value 4 :max-value 6})))
 
     ;; Grant undefined access values in prov3
-    (e/grant-guest (s/context) (e/coll-catalog-item-id "PROV3" (e/coll-id nil {:include_undefined_value true})))
+    (e/grant-guest (s/context) (e/coll-catalog-item-id
+                                "PROV3" (e/coll-id nil {:include_undefined_value true})))
 
     ;; all collections in prov2 granted to guests
     (e/grant-guest (s/context) (e/coll-catalog-item-id "PROV2"))
     ;; grant registered users permission to coll2 and coll4
-    (e/grant-registered-users (s/context) (e/coll-catalog-item-id "PROV1" (e/coll-id ["coll2" "coll4"])))
+    (e/grant-registered-users (s/context) (e/coll-catalog-item-id
+                                           "PROV1" (e/coll-id ["coll2" "coll4"])))
     ;; grant specific group permission to coll3, coll6, and coll8
-    (e/grant-group (s/context) group1-concept-id (e/coll-catalog-item-id "PROV1" (e/coll-id ["coll3"])))
-    (e/grant-group (s/context) group2-concept-id (e/coll-catalog-item-id "PROV2" (e/coll-id ["coll6" "coll8"])))
-    (e/grant-group (s/context) group3-concept-id (e/coll-catalog-item-id "PROV4"
-                                                         (e/coll-id ["coll11-entry-title" "coll12-entry-title"])))
+    (e/grant-group (s/context) group1-concept-id (e/coll-catalog-item-id
+                                                  "PROV1" (e/coll-id ["coll3"])))
+    (e/grant-group (s/context) group2-concept-id (e/coll-catalog-item-id
+                                                  "PROV2" (e/coll-id ["coll6" "coll8"])))
+    (e/grant-group (s/context) group3-concept-id (e/coll-catalog-item-id
+                                                  "PROV4" (e/coll-id ["coll11-entry-title"
+                                                                      "coll12-entry-title"])))
 
     (ingest/reindex-collection-permitted-groups (tc/echo-system-token))
     (index/wait-until-indexed)
 
     (testing "parameter search acl enforcement"
-      (are [token items]
-        (d/refs-match? items (search/find-refs :collection (when token {:token token})))
-
-        ;; not logged in should be guest
+      (util/are3 [token items]
+        (d/assert-refs-match items (search/find-refs :collection (when token {:token token})))
+
+        "not logged in should be guest"
         nil guest-permitted-collections
 
-        ;; login and use guest token
+        "login and use guest token"
         guest-token guest-permitted-collections
 
-        ;; test searching as a user
+        "test searching as a user"
         user1-token [coll2 coll4]
 
-        ;; Test searching with users in groups
+        "Test searching with users in groups - user2"
         user2-token [coll2 coll4 coll3]
+
+        "Test searching with users in groups - user3"
         user3-token [coll2 coll4 coll3 coll6 coll8]))
 
     (testing "token can be sent through a header"
-      (is (d/refs-match? [coll2 coll4]
-                         (search/find-refs :collection {} {:headers {"Echo-Token" user1-token}}))))
+      (d/assert-refs-match [coll2 coll4]
+                           (search/find-refs :collection {} {:headers {"Echo-Token" user1-token}})))
     (testing "aql search parameter enforcement"
-      (is (d/refs-match? [coll2 coll4]
-                         (search/find-refs-with-aql :collection [] {} {:headers {"Echo-Token" user1-token}}))))
+      (d/assert-refs-match [coll2 coll4]
+                           (search/find-refs-with-aql
+                            :collection [] {} {:headers {"Echo-Token" user1-token}})))
     (testing "Direct transformer retrieval acl enforcement"
       (testing "registered user"
         (d/assert-metadata-results-match

      (index/wait-until-indexed)
      (d/assert-refs-match [coll2-2] (search/find-refs :collection {:short-name "short2"}))

      ;; A force reindex all collections will make elastic take the earlier version of the collections.
      (ingest/reindex-all-collections {:force-version true})
      (index/wait-until-indexed)
      (d/assert-refs-match [] (search/find-refs :collection {:short-name "short2"}))
      (d/assert-refs-match [coll2-1] (search/find-refs :collection {:short-name "short1"})))))




;; Verifies that tokens are cached by checking that a logged out token still works after it was used.
;; This isn't the desired behavior. It's just a side effect that shows it's working.
(deftest cache-token-test
  (let [coll1 (d/ingest "PROV1" (dc/collection {:entry-title "coll1"}))
        acl1 (e/grant-registered-users (s/context) (e/coll-catalog-item-id "PROV1" (e/coll-id ["coll1"])))
        user1-token (e/login (s/context) "user1")
        user2-token (e/login (s/context) "user2")]


                         (str "collections.atom?token=" guest-token
                              "&page_size=100&concept_id="
                              (str/join "&concept_id=" concept-ids)))]
          (is (= coll-atom (:results (search/find-concepts-atom
                                      :collection {:token guest-token
                                                   :page-size 100
                                                   :concept-id concept-ids})))))))
    (testing "JSON ACL enforcement"
      (testing "all items"
        (let [coll-json (da/collections->expected-atom
